bb43d9afb35138ac923b9beaa8148d5fa026f352d590f7de302002fa47fd4b8a

Analysis

max time kernel
150s
max time network
92s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
30/05/2024, 08:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

81024e8bcd0f50cd418c924f7d2baa90_NeikiAnalytics.exe
Size

66KB
MD5

81024e8bcd0f50cd418c924f7d2baa90
SHA1

9b28a1cf413adfafabf7fdbd8acf00bfc10f256e
SHA256

bb43d9afb35138ac923b9beaa8148d5fa026f352d590f7de302002fa47fd4b8a
SHA512

21e0fb73b9a1934715a82599d54d7a27f37c46a250a142949968e724087d3db2be20f61d37c9028c9eabb1628952a79076ca389d9016a4450f7683496bca2a10
SSDEEP

1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8Q8/8V:fnyiQSoskV

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (5043) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5072-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x000600000002326f-2.dat	upx
behavioral2/files/0x001d00000002292b-6.dat	upx
behavioral2/memory/5072-1894-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-synch-l1-1-0.dll.tmp	81024e8bcd0f50cd418c924f7d2baa90_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-libraryloader-l1-1-0.dll.tmp	81024e8bcd0f50cd418c924f7d2baa90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\msvcp120.dll.tmp	81024e8bcd0f50cd418c924f7d2baa90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	81024e8bcd0f50cd418c924f7d2baa90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE.tmp	81024e8bcd0f50cd418c924f7d2baa90_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\tabskb.dll.mui.tmp	81024e8bcd0f50cd418c924f7d2baa90_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.TraceSource.dll.tmp	81024e8bcd0f50cd418c924f7d2baa90_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Emit.Lightweight.dll.tmp	81024e8bcd0f50cd418c924f7d2baa90_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.Aero.dll.tmp	81024e8bcd0f50cd418c924f7d2baa90_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationNative_cor3.dll.tmp	81024e8bcd0f50cd418c924f7d2baa90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Grace-ppd.xrm-ms.tmp	81024e8bcd0f50cd418c924f7d2baa90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOSTYLE.DLL.tmp	81024e8bcd0f50cd418c924f7d2baa90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml.tmp	81024e8bcd0f50cd418c924f7d2baa90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\id\msipc.dll.mui.tmp	81024e8bcd0f50cd418c924f7d2baa90_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ru-RU\tipresx.dll.mui.tmp	81024e8bcd0f50cd418c924f7d2baa90_NeikiAnalytics.exe
File created	C:\Program Files\desktop.ini.tmp	81024e8bcd0f50cd418c924f7d2baa90_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Printing.dll.tmp	81024e8bcd0f50cd418c924f7d2baa90_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-filesystem-l1-1-0.dll.tmp	81024e8bcd0f50cd418c924f7d2baa90_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-runtime-l1-1-0.dll.tmp	81024e8bcd0f50cd418c924f7d2baa90_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\jaccess.jar.tmp	81024e8bcd0f50cd418c924f7d2baa90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_OEM_Perp-ppd.xrm-ms.tmp	81024e8bcd0f50cd418c924f7d2baa90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN075.XML.tmp	81024e8bcd0f50cd418c924f7d2baa90_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-rtlsupport-l1-1-0.dll.tmp	81024e8bcd0f50cd418c924f7d2baa90_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.Concurrent.dll.tmp	81024e8bcd0f50cd418c924f7d2baa90_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.Tools.dll.tmp	81024e8bcd0f50cd418c924f7d2baa90_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\PresentationUI.resources.dll.tmp	81024e8bcd0f50cd418c924f7d2baa90_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\ffjcext.zip.tmp	81024e8bcd0f50cd418c924f7d2baa90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-black_scale-140.png.tmp	81024e8bcd0f50cd418c924f7d2baa90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\BREEZE.WAV.tmp	81024e8bcd0f50cd418c924f7d2baa90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Grace-ppd.xrm-ms.tmp	81024e8bcd0f50cd418c924f7d2baa90_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\TipRes.dll.mui.tmp	81024e8bcd0f50cd418c924f7d2baa90_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msdaremr.dll.mui.tmp	81024e8bcd0f50cd418c924f7d2baa90_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Formats.Tar.dll.tmp	81024e8bcd0f50cd418c924f7d2baa90_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\PresentationUI.resources.dll.tmp	81024e8bcd0f50cd418c924f7d2baa90_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\access-bridge-64.jar.tmp	81024e8bcd0f50cd418c924f7d2baa90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml.tmp	81024e8bcd0f50cd418c924f7d2baa90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Grace-ppd.xrm-ms.tmp	81024e8bcd0f50cd418c924f7d2baa90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019MSDNR_Retail-ppd.xrm-ms.tmp	81024e8bcd0f50cd418c924f7d2baa90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Cyrl-BA\msipc.dll.mui.tmp	81024e8bcd0f50cd418c924f7d2baa90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\comments.win32.tpn.tmp	81024e8bcd0f50cd418c924f7d2baa90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoutilstat.etw.man.tmp	81024e8bcd0f50cd418c924f7d2baa90_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Windows.Input.Manipulations.resources.dll.tmp	81024e8bcd0f50cd418c924f7d2baa90_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\WindowsBase.resources.dll.tmp	81024e8bcd0f50cd418c924f7d2baa90_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md.tmp	81024e8bcd0f50cd418c924f7d2baa90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe.tmp	81024e8bcd0f50cd418c924f7d2baa90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Grace-ppd.xrm-ms.tmp	81024e8bcd0f50cd418c924f7d2baa90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART13.BDR.tmp	81024e8bcd0f50cd418c924f7d2baa90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-white_scale-80.png.tmp	81024e8bcd0f50cd418c924f7d2baa90_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.Serialization.dll.tmp	81024e8bcd0f50cd418c924f7d2baa90_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\ReachFramework.resources.dll.tmp	81024e8bcd0f50cd418c924f7d2baa90_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Windows.Forms.Design.resources.dll.tmp	81024e8bcd0f50cd418c924f7d2baa90_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\PresentationFramework.resources.dll.tmp	81024e8bcd0f50cd418c924f7d2baa90_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-handle-l1-1-0.dll.tmp	81024e8bcd0f50cd418c924f7d2baa90_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-runtime-l1-1-0.dll.tmp	81024e8bcd0f50cd418c924f7d2baa90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_MAK_AE-ul-oob.xrm-ms.tmp	81024e8bcd0f50cd418c924f7d2baa90_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msdaprsr.dll.mui.tmp	81024e8bcd0f50cd418c924f7d2baa90_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\JAWTAccessBridge-64.dll.tmp	81024e8bcd0f50cd418c924f7d2baa90_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.da-dk.dll.tmp	81024e8bcd0f50cd418c924f7d2baa90_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\UIAutomationClientSideProviders.resources.dll.tmp	81024e8bcd0f50cd418c924f7d2baa90_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Diagnostics.EventLog.Messages.dll.tmp	81024e8bcd0f50cd418c924f7d2baa90_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Configuration.ConfigurationManager.dll.tmp	81024e8bcd0f50cd418c924f7d2baa90_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe.tmp	81024e8bcd0f50cd418c924f7d2baa90_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\JavaAccessBridge-64.dll.tmp	81024e8bcd0f50cd418c924f7d2baa90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Cyrl-RS\msipc.dll.mui.tmp	81024e8bcd0f50cd418c924f7d2baa90_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\81024e8bcd0f50cd418c924f7d2baa90_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\81024e8bcd0f50cd418c924f7d2baa90_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:5072

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2539840389-1261165778-1087677076-1000\desktop.ini.tmp

Filesize
66KB

MD5
8c7cf8d43ce9d8c953d68cf56e6f3e37

SHA1
a31832a1e88b8916f25f71657e152b172d309a25

SHA256
9d758fdfd2cab3386f5d6c88f1595647fffc50c60e5e1dc81baa1b85ab18e9b5

SHA512
085a430bd93b9cf6c6369b8603cdf8c53eb6bffe7fb94b6a72923fa889c67653f5d8f59668bd02992af591dda3766d2cc7f73e65ef420eedce6ab73a354d7b85

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
165KB

MD5
f0d5db9c797961f15cc73008df528d8a

SHA1
d3c707a898f630b3c81a6ea5fe80937e2e4cc938

SHA256
b818d55d57f915e3cf5074b85ba38460c29ce1af5e22b30ed6c5a1fb3eb1a8c6

SHA512
058b1b94b91f465e4c1bf91c9c1e31f3d8418069171cd814d7b8146f07a2fff79f59a3b7bf59deb958c2c2e97a8db4a703221dc72fd3015a873d255b9d028404

Download Submit
memory/5072-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/5072-1894-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads